BiShield-TEE: Security Analysis of One-Sided Weight Obfuscation in On-Device TEE-Protected LLM Partitioning

1. 01What problem does this paper attempt to solve?

   The key of one-sided TEE weight obfuscation can be uniquely estimated; the authors use two-sided obfuscation to push the attack back to black-box level.

   If an on-device TEE partition applies one-sided obfuscation only on the weight output side, the secret transformation can be uniquely estimated, and the protection degrades to near white-box.

   • Scenario: The authors state that on-device deployment can reduce latency and enhance privacy through local processing, but the model remains on the user's device, facing white-box reverse engineering and intellectual-property theft. The authors argue that these high-value models must therefore be protected.
   • Existing shortcomings: Edge TEEs have limited compute and memory, so running the entire model inside the TEE is impractical. Existing partition schemes put heavy computation on untrusted accelerators and only right-multiply the weights by a secret matrix; the authors argue that they all obfuscate only the output side.
   • Core observation: If the victim model is fine-tuned from a public pretrained model, least-squares estimation will be close to the true key and inherit its sparse or low-rank structure. The authors call this unique recoverability the Solution Determinacy Property (SDP).
   • This paper proposes: The authors reconstruct GroupCover via its block-diagonal structure and ArrowCloak via its shared-mask low-rank structure, and claim this is the first successful attack on both; they then propose a two-sided framework, BiShield-TEE, which hides the true key among multiple equally valid candidates.
   • Threat model:
     • Goal: Make the extracted surrogate Msur clearly less useful than the victim model Mvic, reducing the attacker's effective capability from white-box to black-box.
     • Knowledge: Knows the defense mechanism, cannot read secrets inside the TEE; the paper assumes Mvic is fine-tuned from a public model Mpre.
     • Capability: Fully controls the obfuscated model, runtime traces, and software stack outside the TEE. Reconstruction is query-free, using only Wpre and the obfuscated weights; queries are used only for downstream adaptation, with a budget less than 1% of training data.
     • Victim system: A user-controlled device with TEE; the obfuscated model runs on the GPU, while keys and recovery logic remain inside the TEE.

   Collapse this answer

2. 02What related research exists?

   Related work is divided into on-device theft, TEE, and partition obfuscation; the authors place the distinction in the SDP of one-sided schemes.

   The authors position this paper among on-device model stealing, TEE as a root of trust, and partitioned execution with output-only obfuscation.

   On-device model stealing

   • White-box and fully shielded black-box: Deploying a proprietary model Mvic to edge devices exposes it to model stealing and intellectual-property leakage. Without protection, an attacker can directly extract weights to build a high-fidelity surrogate; a fully shielded black-box keeps all parameters inside the TEE.
   • Goal of this paper: The authors aim to reduce the attacker's effective capability from white-box to black-box, thereby limiting the utility of the surrogate Msur.

   TEE as a root of trust

   • SGX: TEEs use hardware to isolate code and data from the host OS. Intel SGX provides encrypted enclaves and supports remote attestation, so that the integrity of inference code can be verified before proprietary weights are released.
   • Usage: Following prior work, the authors treat the TEE as a root of trust, storing obfuscation keys and performing lightweight de-obfuscation, while placing heavy computation on untrusted accelerators.

   Partitioned execution and one-sided obfuscation

   • Per-vector schemes: Table 1 classifies SOTER (ATC'22), ShadowNet (S&P'23), TLG (MM'24), and TSQP (S&P'25) as per-vector scaling or permutation. The authors state that such schemes are insecure when fine-tuned from public checkpoints; existing attacks read out keys via column-direction similarity, but the authors state these do not work against GroupCover and ArrowCloak.

   • More complex one-sided schemes: GroupCover (ICML'24) mixes output columns within groups; ArrowCloak (USENIX Sec'25) adds a shared mask to all columns. The authors note that these, along with per-vector schemes, all act only on the output side of W.

   • Two-sided and intermediate features: AMULET (2025) also performs two-sided weight obfuscation, with a design focus on reducing TEE interactions during inference. For intermediate features, the authors follow integrity checks and one-time pads (OTP).

   • Baseline methods: White-box (full plaintext), black-box (replacement with pretrained weights), and TLG, GroupCover, ArrowCloak.

   • Benchmarks/datasets: CIFAR-10, CIFAR-100, Food-101; GLUE's SST2, QQP, QNLI, MNLI; GSM8K, IFEval.

   The authors place the distinction on SDP: existing one-sided schemes restrict obfuscation to the output side, this paper reconstructs against that leakage and uses lightweight two-sided transformations to resist reconstruction; the difference from AMULET is that the latter focuses on reducing TEE interactions.

   Collapse this answer

3. 03How does the paper address this problem?

   BiShield-TEE applies scaling and Householder on both sides of the weights, making key recovery non-unique.

   The authors first formalize the unique estimability of one-sided obfuscation as SDP and reconstruct GroupCover and ArrowCloak accordingly, then use BiShield-TEE to obfuscate both the input and output sides, making key recovery an ill-posed problem.

   One-Sided Setting and SDP

   • Right multiplication obfuscation: The main outsourced computation in partitioned inference is linear matrix multiplication. One-sided defenses write Wobf as Wvic right-multiplied by a secret invertible matrix T; after the GPU computes the obfuscated output, the TEE uses the inverse of T to recover the true output.
   • Estimation formula: The victim model is written as public weights plus a small fine-tuning delta. The least squares estimate is written as T̂=W_pre^†W_obf, i.e., fitting the observed obfuscated weights with the pseudoinverse of the public pretrained weights.
   • Structural leakage: The authors state that when the delta is small, the estimate will be close to the true T and preserve its structure. Dense random T lacks exploitable structure, but applying the inverse transformation inside the TEE is too costly, so existing defenses impose sparse or low-rank constraints on T, and these constraints are inherited by the estimate.
   • Difference from old attacks: Estimates for per-vector schemes concentrate on the true permutation or scaling positions. The authors state that existing attacks that only compare column directions cannot break GroupCover and ArrowCloak because both further scramble column directions.

   Reconstruction of Two One-Sided Schemes

   • GroupCover: Output columns are divided into groups of size s, with independent linear mixing within each group, then row and column permutations hide group membership; overall it is a block-diagonal transformation under permutation. The paper states the default group size is 4. The quality of each column of the estimated matrix is concentrated on a few indices, and the group size can be inferred from the number of dominant terms per row or column.
   • Reconstruction after grouping: First recover the grouping by overlapping row indices of maximum-magnitude terms, then split the global reconstruction into low-dimensional least squares per group, selecting candidate groups by cosine similarity. Appendix B states that once the grouping is broken, the parameter recovery error is about s/d of the black-box setting; s is much smaller than the matrix dimension d. Appendix C gives normalization, grouping process, and complexity, not expanded here.
   • ArrowCloak: Per-column scaling, column permutation, plus a mask shared by all columns; the mask direction is determined by a secret coefficient vector. This shared vector becomes the dominant direction of Wobf.
   • Three-step exploitation: Use PCA to take the first principal component as the mask direction, project the obfuscation matrix onto the orthogonal complement of that direction to recover column correspondence, then perform least squares per column to fit scaling and residual mask weights. Figure 5b notes the first principal component explains 99.993% of variance, the rest 0.0003%; the authors state that the cosine similarity between this direction and the true mask exceeds 99.99% across all evaluated layers.

   BiShield-TEE

   • Two-sided transformation: For weight matrices, the two-sided form is written as W_obf=T_l W_vic T_r, i.e., multiplying by a secret matrix on both the input and output sides. Each side is diagonal scaling followed by a Householder matrix; the inverse of a Householder matrix is itself, so the inverse can be computed inside the TEE.
   • Linear layers: Each forward pass resamples an independent scaling-plus-Householder transformation inside the TEE, first processing the input so that the left-side obfuscation is canceled during the multiplication on the GPU; after the result returns to the TEE, the runtime transformation and the right-side transformation are removed.
   • Self-attention: Q, K, V, and the output projection all undergo two-sided obfuscation. In Figure 3, the right-side keys of K and Q are set to be inverses of each other, canceling in the dot product; before and after softmax, recovery and re-obfuscation occur inside the TEE, so that the corresponding factors of V and the output projection cancel.
   • Overhead sources: The TEE side only does Householder and scaling; dense matrix multiplication is on the GPU. The authors state that applying Householder can be reduced to two matrix–vector multiplications, and the number of TEE entries/exits is the same as one-sided schemes.

   Indistinguishability and Supporting Protections

   • Ambiguous Solutions: Given obfuscated weights and the pretrained model, under the fine-tuning relaxation, a set of scaling-plus-Householder pairs is observationally indistinguishable. The authors state that the true key is therefore hidden among multiple equally valid candidates. Appendix D discusses the sign symmetry of Householder, the reciprocal scaling of two-sided diagonal scaling, and that when the residual tolerance is higher than the true residual, a string of different reconstructed weights is possible.
   • Implication of fitting pretrained weights: The objective in the formula is to be close to Wpre; a smaller residual does not mean better recovery of the private fine-tuning delta. The authors state that if the public checkpoint itself lies in the image of the recovery mapping, a zero-residual solution would reproduce the public checkpoint.
   • Attack definition for two-sided: Recovering only one side, and alternating fitting on both sides. The joint version fixes one side and fits the other, making the reconstructed weights close to Wpre, with the number of iterations fixed at 5. The authors state that more iterations only push the reconstruction toward Wpre, not Wvic.
   • Intermediate features: They reuse Freivalds' integrity check and one-time pad; the low-rank OTP writes the mask as two low-rank factors to reduce TEE storage, with details in Appendix H. Appendix E.2 states that the mask is refreshed each forward pass, so query-based accumulation of intermediate states yields no consistent information.

   Collapse this answer

4. 04What experiments did the paper conduct?

   GroupCover and ArrowCloak have an average Rel. Black of 2.44×, while BiShield has an adaptive average of 1.00×.

   The reconstruction attack on one-sided schemes raises the average Rel. Black to the same order as white-box; under the strongest adaptive attack as defined by the authors, BiShield-TEE achieves an average Rel. Black of 1.00×.

   Experimental Setup

   • Models: ViT-Base, ViT-Large, GPT2-Base, Llama3.2-1B, Llama3.2-3B. Victim models are fully fine-tuned from public checkpoints, taking the checkpoint with the highest validation accuracy. For Llama, the public base model is the attack starting point, and the instruction-tuned model is the victim.
   • Data and queries: Vision uses CIFAR-10, CIFAR-100, Food-101; GPT2-Base uses SST2, QQP, QNLI, MNLI; Llama uses GSM8K and IFEval. Reconstruction itself is query-free. For non-Llama models, only the proxy's classification head is retrained, with labels from querying the victim model; in Table 7, the proxy set is 0.04%–0.50% of the victim training set, and the paper states the budget is less than 1% of the training data.
   • Baselines: White-box is full plaintext; black-box replaces weights with pretrained weights. One-sided comparisons are TLG, GroupCover, ArrowCloak. Rel. Black is attack accuracy divided by the black-box baseline; close to 1× means returning to black-box level.
   • Evaluation: Classification and GLUE report accuracy. GSM8K is 8-shot, strict-match; IFEval is 0-shot, taking the average of Prompt-Strict and Instruction-Strict. Llama uses lm-evaluation-harness, and only intermediate Transformer layers are obfuscated; no retraining after reconstruction. The paper does not use LLM judges.
   • Repeats: Accuracy takes the highest value across five independent runs; the paper does not perform statistical tests on accuracy. End-to-end latency is the mean and standard deviation of 10 complete forward passes after warmup.
   • Hardware: Training uses a single NVIDIA A800-80G, PyTorch 2.7.1, CUDA 12.8. Latency is measured on Intel Xeon W-1250 (SGX1, physical EPC 93.5 MiB) and RTX 5060 Ti, based on Gramine.

   Main Results

   The table below is excerpted from Table 2, with Rel. Black in parentheses. Rows not listed are ViT-Base on CIFAR-100 and Food-101, ViT-Large on CIFAR-100, GPT2-Base on SST2, QQP, QNLI, and Llama3.2-1B on IFEVAL, Llama3.2-3B on GSM8K. Table 2 does not have ViT-Large / CIFAR-10.

   Swipe horizontally to read the table

   Model / Data	GroupCover	ArrowCloak	White-box	Black-box
   ViT-Base / CIFAR-10	98.4% (1.55×)	98.5% (1.55×)	98.1% (1.55×)	63.4%
   ViT-Large / Food-101	86.9% (1.33×)	85.9% (1.32×)	85.5% (1.31×)	65.3%
   GPT2-Base / MNLI	80.5% (1.69×)	80.4% (1.69×)	80.8% (1.69×)	47.7%
   Llama3.2-1B / GSM8K	31.8% (4.75×)	30.7% (4.58×)	35.5% (5.30×)	6.7%
   Llama3.2-3B / IFEVAL	71.7% (6.83×)	73.8% (7.03×)	73.5% (7.00×)	10.5%
   Table 2 Average	2.44×	2.44×	2.49×	1.00×

   • Authors' interpretation: The authors state that the average ratios for GroupCover and ArrowCloak are close to the white-box upper bound, across vision, language understanding, and reasoning, and attribute the leakage to the one-sided obfuscation itself. The abstract states over 2.4×, and Table 2's Average row is 2.44×.
   • TLG: In Table 2, TLG's average Rel. Black is 2.47×. The authors state this is consistent with previous work.
   • Not identical to white-box peers: In several rows, attack accuracy is higher or lower than the peer white-box accuracy. An example not in the table is ViT-Base / Food-101: GroupCover is 85.6%, white-box is 83.4% (Table 2). In Figure 4, the authors state that the attack accuracy of these two one-sided schemes does not decrease with the number of protected layers; the text does not give values for each point.

   Adaptive Attacks on BiShield-TEE

   • Four strategies: Parameter replacement (black-box baseline), recovering only the input side, recovering only the output side, and alternating fitting on both sides. The authors state that when only one side is recovered, the other side is still missing, so one-sided reconstruction cannot directly break two-sided protection.
   • Llama differs from other models: In Table 3, Llama3.2-1B and Llama3.2-3B have Input-Only and Output-Only at 0.0% on GSM8K and IFEval; the authors state the proxy cannot produce coherent outputs. ViT and GPT2 are not this number: ViT-Base / CIFAR-10 Input-Only is 10.7%, Output-Only is 14.8%; GPT2-Base / SST2 Input-Only is 56.2%, parameter replacement is 63.0%.
   • Table 4 comparison method: BiShield takes the highest attack accuracy across adaptive strategies, and one-sided schemes take the lowest attack accuracy from Table 2. Even so, the average Rel. Black is 1.00×, and Prior Best is 2.42×. Not every row is 1.00×: Llama3.2-1B / GSM8K is 1.04% (7.0% vs. black-box 6.7%), Llama3.2-3B / GSM8K is 1.01× (28.0%). Llama3.2-3B / IFEVAL joint attack is 9.4%, lower than parameter replacement 10.5%.

   Authorized Utility and End-to-End Latency

   • Authorized outputs: In Table 5, on datasets listed for all five models, Obfuscated and Original are identical item-by-item, e.g., Llama3.2-3B on GSM8K and IFEVAL are both 64.4% and 73.5%. The authors state that the inverse transformation in the TEE restores the original outputs.
   • Latency: Table 9 inputs are ViT batch 1, sequence length 197; GPT2-Base and the two Llama models are batch 2, sequence length 64. The authors state that BiShield-TEE has the lowest latency across the five models; the text states average speedups of 1.70× and 1.46×, and Table 6's Mean Ratio is the same two numbers. On Llama3.2-3B, the three are 9848.23±74.23, 8441.53±32.54, 5148.10±7.22 ms.
   • Key footprint: Table 10 is the transformation key footprint inside the TEE, not total enclave memory. The authors state that across the five models, it is on average 19.0% smaller than ArrowCloak and 45.5% smaller than GroupCover.

   Other Ablations and Analyses

   • Fine-tuning magnitude: Appendix F multiplies the fine-tuning delta by α on ViT-Base / CIFAR-100. The authors state that for α≤2, the attack remains close to the victim model's own accuracy; for α=1.8 and 2.0, CKA is about 0.5–0.6; for α=2, victim accuracy is below 82%; for α≥2.5, it is below 70%, and the authors consider the model would not be deployed.
   • Removing diagonal scaling: In Table 11, with only two-sided Householder, the average Rel. Black is 1.34×, with a maximum of 2.37× (Llama3.2-3B / IFEval); the full design averages 1.00×. The authors state that Householder provides key ambiguity, but in high dimensions the weight displacement can still be small; diagonal scaling is used to increase reconstruction error under wrong keys.
   • Diagnostic plots: In Figure 5a, the authors state that the dominant terms of the preprocessed estimated matrix are concentrated in the block-diagonal region. Figure 5b's 99.993% and over 99.99% are as above.
   • Iterative and learned recovery: Joint recovery iterations are fixed at 5; the authors state that more iterations only push the reconstruction toward Wpre. They also state that learned recovery lacks a usable initialization, and since keys are indistinguishable, gradient optimization may stop at a solution far from the true key (Appendix E.2).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors state that real-machine testing covered only Intel SGX, quantization is not supported, and TEE side channels were not analyzed.

   In Section 7, the authors state that real-machine testing covered only Intel SGX, the current design does not support quantized inference, and TEE side channels were not included in the analysis.

   Limitations and future directions noted by the authors

   • TEE types: Real-machine evaluation is limited to Intel SGX; other TEEs such as Arm TrustZone remain to be tested (Section 7).
   • Quantization: The current design does not support quantized inference, because INT8/INT4 scaling, truncation, and rounding may break the algebraic relations used to recover outputs (Section 7).
   • Side channels: The analysis does not consider side-channel attacks against the TEE (Section 7).
   • Model updates: Model updates in on-device fine-tuning and federated learning may introduce additional privacy risks, left for future research (Section 7).

   Experimental coverage

   • Models and tasks: The tested models are ViT-Base, ViT-Large, GPT2-Base, Llama3.2-1B, and Llama3.2-3B, 5 in total (Section 6.1). The tasks in Table 2 are CIFAR-10, CIFAR-100, Food-101, SST2, QQP, QNLI, MNLI, GSM8K, and IFEval; among these, there is no ViT-Large / CIFAR-10.
   • Baselines and attack strategies: One-sided baselines are TLG, GroupCover, and ArrowCloak; strategies against BiShield-TEE are Input-Only, Output-Only, Joint I&O, and parameter replacement (Table 2, Table 3).
   • Measurement protocol: Accuracy takes the highest value over five independent runs; latency is measured after warm-up on an SGX1 workstation, repeated 10 times (checklist note, Appendix E.5, Table 6). Input configurations are in Table 9.
   • Llama and queries: For Llama, only intermediate Transformer layers are obfuscated, and after reconstruction, evaluation is done directly with lm-evaluation-harness (Appendix E.1, E.2). The paper states that the query budget is less than 1% of training data, and Table 7 lists the proxy-set ratios for each non-Llama dataset.
   • GPU TEE: Section 7 states that existing GPU TEEs target server platforms such as NVIDIA H100 or may require firmware modifications, and are incompatible with commodity edge GPUs; BiShield-TEE therefore uses an algorithm design that does not rely on a GPU TEE. The fine-tuning magnitude sweep changes α only on ViT-Base / CIFAR-100 (Appendix F).

   Collapse this answer

6. 06Summarize the main content of the paper

   One-sided obfuscation can be reconstructed due to SDP; BiShield-TEE reduces the average Rel. Black from 2.44× to 1.00×.

   This work simultaneously reconstructs two one-sided TEE weight obfuscations and uses the two-sided scheme BiShield-TEE to push the attack back to fully masked black-box level.

   • Problem: On-device partitioned inference places linear layers on the GPU outside the TEE, protecting weights only with a secret transformation on the output side. If the victim model is fine-tuned from a public checkpoint, that transformation can be uniquely estimated by least squares; the authors call this SDP.
   • Attack: GroupCover's estimate preserves block-diagonal grouping, and ArrowCloak's shared mask becomes the dominant principal component of the obfuscation matrix. The authors call this the first successful attack on these two schemes. The reconstruction phase is query-free; for non-Llama models, they also retrain the classification head with queries less than 1% of the training data.
   • Defense: BiShield-TEE applies diagonal scaling plus Householder on both the input and output sides, and in self-attention lets some right-side keys cancel. The authors state that this yields multiple equally valid candidates, so fitting only public weights cannot reliably find the private fine-tuning delta.
   • One-sided results: In Table 2, GroupCover and ArrowCloak both have an average Rel. Black of 2.44×, and white-box average is 2.49×; the abstract and conclusion state over 2.4×. The ratios vary greatly by task; ArrowCloak is 7.03× on Llama3.2-3B / IFEVAL.
   • Two-sided and overhead: In Table 4, when taking the highest adaptive attack accuracy for BiShield and the lowest attack accuracy for one-sided schemes, the average Rel. Black is 1.00×; Llama3.2-1B / GSM8K is 1.04×, and Llama3.2-3B / GSM8K is 1.01×. In Table 5, authorized accuracy is identical item-by-item to the unobfuscated model. In Table 6, the average latency ratios relative to GroupCover and ArrowCloak are 1.70× and 1.46×.
   • Authors' conclusion: The authors argue that one-sided defenses degrade to near white-box, while two-sided obfuscation limits the attack to the black-box baseline and reduces inference latency on real hardware. Section 7 also states that only Intel SGX was tested, quantized inference is not supported, and TEE side channels were not analyzed.

   Collapse this answer

Related papers